The vulnerability resides in the FreePBX Logfiles module, where untrusted input is incorporated into SQL queries without proper sanitization. The flaw permits authenticated users to inject arbitrary SQL commands, enabling the disclosure of sensitive data or modification of database records. Depending on the database and user privileges, an attacker could alter configuration settings, gain elevated privileges, or facilitate further compromise.

FreePBX, an open‑source IP PBX platform managed by Sangoma, is affected. The flaw is present in releases prior to version 16.0.10 and 17.0.5, including all earlier 16.0.x and 17.0.x builds. The vulnerable component is the Logfiles module, which is part of the core FreePBX distribution.

The CVSS score of 8.6 classifies this as a high‑severity issue. The EPSS score of less than 1% indicates a low probability that the vulnerability is actively exploited in the wild, likely due to its requirement for authenticated access. The flaw does not appear in the CISA Known Exploited Vulnerabilities list. Attackers would need valid credentials and access to the Logfiles module to exploit the injection; thus insider or compromised administrator accounts pose the primary threat vector.